CVEvulnerability

CVE-2015-5345

5.3 MEDIUM Published 2016-02-25 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2016-02-25
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Affected configurations

• debian debian linux 7.0 • debian debian linux 8.0 • apache tomcat 6.0.0 • apache tomcat 6.0.1 • apache tomcat 6.0.2 • apache tomcat 6.0.4 • apache tomcat 6.0.10 • apache tomcat 6.0.11 • apache tomcat 6.0.13 • apache tomcat 6.0.14 • apache tomcat 6.0.16 • apache tomcat 6.0.18 • apache tomcat 6.0.20 • apache tomcat 6.0.24 • apache tomcat 6.0.26 • apache tomcat 6.0.28 • apache tomcat 6.0.29 • apache tomcat 6.0.30 • apache tomcat 6.0.32 • apache tomcat 6.0.33 • apache tomcat 6.0.35 • apache tomcat 6.0.36 • apache tomcat 6.0.37 • apache tomcat 6.0.39 • apache tomcat 6.0.41 • apache tomcat 6.0.43 • apache tomcat 6.0.44 • apache tomcat 7.0.0 • apache tomcat 7.0.2 • apache tomcat 7.0.4 • apache tomcat 7.0.5 • apache tomcat 7.0.6 • apache tomcat 7.0.10 • apache tomcat 7.0.11 • apache tomcat 7.0.12 • apache tomcat 7.0.14 • apache tomcat 7.0.16 • apache tomcat 7.0.19 • apache tomcat 7.0.20 • apache tomcat 7.0.21 • apache tomcat 7.0.22 • apache tomcat 7.0.23 • apache tomcat 7.0.25 • apache tomcat 7.0.26 • apache tomcat 7.0.27 • apache tomcat 7.0.28 • apache tomcat 7.0.29 • apache tomcat 7.0.30 • apache tomcat 7.0.32 • apache tomcat 7.0.33 • apache tomcat 7.0.34 • apache tomcat 7.0.35 • apache tomcat 7.0.37 • apache tomcat 7.0.39 • apache tomcat 7.0.40 • apache tomcat 7.0.41 • apache tomcat 7.0.42 • apache tomcat 7.0.47 • apache tomcat 7.0.50 • apache tomcat 7.0.52 … and 34 more

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References